SB2019050317 - Fedora 30 update for kubernetes

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019050317

SB2019050317 - Fedora 30 update for kubernetes

Published: May 3, 2019 Updated: April 25, 2025

Security Bulletin ID SB2019050317
Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Link following (CVE-ID: CVE-2019-1002101)

The vulnerability allows a local non-authenticated attacker to manipulate data.

The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes creates a tar inside the container, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user’s machine when kubectl cp is called, limited only by the system permissions of the local user. The untar function can both create and follow symbolic links. The issue is resolved in kubectl v1.11.9, v1.12.7, v1.13.5, and v1.14.0.


Remediation

Install update from vendor's website.

References